c4196664605b1bf1c8fa1095b87821d091ad13775b92bce59ea07150f76ee90b

Analysis

max time kernel
148s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Size 2.0MB
Sample260511-ctnccsat2w
SHA256 c4196664605b1bf1c8fa1095b87821d091ad13775b92bce59ea07150f76ee90b
MD5 c0a6ed5ad36b486cf918119480145c75
SHA1 a6ccdd0207ece85387c23558a94cb9a4eed5ceac
SHA512 f86deda612bcc14df21c44c443548fd040af3e65e685e649977f3098c2245ed8dde004c5eb13deba34f2ca36d9beb48f70ddc9876bbe128a78173c87f6b14753
SSDEEP 49152:GDWbaWpY4xmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNFiT:GDWbtQBiZ5s5IDepwM1y/AIqNVw45JiT
TLSH
T1D3A58D1276D5D036F5B312319DB9922899B6BCA18A35849FB3DC271E4F706D18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5204	javasetup8u18132.exe
5092	eventviewer.exe
5892	javasetup8u18132.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2968	1360	WerFault.exe	79
2400	5092	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasetup8u18132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasetup8u18132.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5092	eventviewer.exe
5092	eventviewer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5892	javasetup8u18132.exe
5892	javasetup8u18132.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 5204	1360	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe	80
PID 1360 wrote to memory of 5092	1360	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe	81
PID 5204 wrote to memory of 5892	5204	javasetup8u18132.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\javasetup8u18132.exe
  "javasetup8u18132.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Users\Admin\AppData\Local\Temp\jds240650843.tmp\javasetup8u18132.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240650843.tmp\javasetup8u18132.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5892
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 1588
    3⤵
    - Program crash
    PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 1448
  2⤵
  - Program crash
  PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5092 -ip 5092
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1360 -ip 1360
1⤵
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 215KB
SHA256 717982247068f79ceff17d9a94d84a3d21f3dc85d337744b75d9fd34bbafad98
MD5 083ff74028c735d8d04662eed477cd0b
SHA1 a38c3f6ac6424f10b1b93b754637a7d63605761a
SHA512 9449c33297da721b424d967381944df1e658cdad8f1b8e3f810ed44ec13aa9896b4dd4c44f0b87cb5176f72a78177bfc9e489b7285030b25c2f07ce707aa435e
SSDEEP 3072:Lb5oiaFrgqmpK92MZ/PXV+gX8eP6t7EmMHpZJXU:LYFrQpcnQiHHJXU
TLSH
T101244C68AC77F161BCA98E924DE9EA9A63E7BDF51611030F4E70BF502C03A97DB57001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 5ec11b06285241af1afdaa7f659d2be44991f7f2531067181a3bfc238ace1a47
MD5 52800e703459bacbf757969796141007
SHA1 0d96f58b60b945d4f9ec38bd02315d90b82b8ee9
SHA512 ccfdcb5a26d72bfb20ee1aee93c5bff3c201e74a95afbfd8fc4ded86f81393047a3ece7080a9ca4e69ff030d7a32866131205d3b99719fcaa134c716270b37fc
TLSH
T1BAC08C080E9A0625E08403BA012089021E10A504E28BFF0E0BB52A5809A5F211810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 7984215fb4b45abc9a0d6b8826b78ee06bf61616615e3ca592cb8484894f25cf
MD5 0eca697d28ef1913e981283269e0bf4d
SHA1 368073f4bb125f791c0131044cc2cdf021c8081f
SHA512 890268b6d4aa28d1dcd46037b5493930c78f07ee04128875c4ce43e8a78d7effbfe324c93bd5aab5a889c37dfde1d48fa4846f3347cc06303e17b67f5a81ceb3
TLSH
T145D0223C0B30073AF230C33BE8A982131E506813BAB14B0910B70A1CACA6F220C90E08
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 fe78fad91bf368f316fa0fceda426b960e6edd3b20051960774e6334695e3bb8
MD5 77532026905dc0fb0cd74b1d5b5b8cdd
SHA1 265c7cf9e5ee0bbc9d95fa50a99515eb2ac675e5
SHA512 0772b4dd47724231c357f56158b77704b7eff46918fd84f4147c9e1fe93099d041b5b3d43d0e177e6a7d7c86d33d4ee0c89b0db5c04b91a240c45a5554c3b15e
TLSH
T14DD08C381B71133EF274C23F98BA02031E80A802B9A09B4A10B74B5C9C27F631DA0F08
MD5 SHA1 SHA512 TLSH

Submit Download

javasetup8u18132.exe

Path C:\Users\Admin\AppData\Local\Temp\javasetup8u18132.exe
Size 1.8MB
SHA256 a8fb1a1473831ac6feb092afd2cbdded2d6a881d3576158fabd89090050b52f8
MD5 544e07d620d3108b9b6aa3384d02dea5
SHA1 9897596f3c4ec39e38ef7f1081783db7693ae0b2
SHA512 3663b9c056447c4491635b5bdcbc6e1a2b67a432b41bab6f479da5c787c48f1067cecafdfb6d9763f9b17b553aa953ae87068ba7f0c1c93facf34db7ac53a64c
SSDEEP 49152:+WpY4xmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNz:JQBiZ5s5IDepwM1y/AIqNVw45H
TLSH
T14D958D1276D5D036F5B312319DB992289976BCA28A39849FB3DD131E4F706D18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javasetup8u18132.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240650843.tmp\javasetup8u18132.exe
Size 1.6MB
SHA256 394ad6212e4866cc8e6d1834df8f70538dddf09d23dfa65ea204b22c012b541a
MD5 109cbe148f827137c3ba62261f01b29b
SHA1 2cc02b09da46d9e5d0ac1b306a0bbcc12bfe4c12
SHA512 a2dfa03dd290540bcfeda6cfd7d6ed891700742b4323d8c8dbfc4c822386ef1ddfff5cf71b2e5d7be9ec72fb6fc2145ff6ffc440823187d6956d5aa2794c5799
SSDEEP 49152:VxmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNJ:VQBiZ5s5IDepwM1y/AIqNVw45F
TLSH
T179758D1277E59135F5B313319D7992285576B8A28A3984EFB3DD021E8F70AD18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 95fe8dff12c2a0e306a4846bce3437e5ec4f30560b8315128f1539406f72ecd6
MD5 863000d6b76f3ca32917c5fcfdda424a
SHA1 a9fcb64974abdb6ea8518673f407db1dc617a0e4
SHA512 a25618c293953587d8d665f91d8d124146a9fd9d34d6f396362869c41bbbaffc044f04d7bc6ccb71add2114d88a023a6da61318f59d63ee50f40d3729564f492
SSDEEP 3072:+gTZU95FDE0igS/13TJkdZl3hOQrrlsTis/g6Fz9bAE:fvnZ
TLSH
T154F34352C92F53BF30234AD783A97DA44653060F639E0A3C72DF829E5505907E96F8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 8fc315d9ef2b51c1101925e122f8dfe3522eaca5449773e8762c1b82d04b3f22
MD5 e40f9a48b58c7d5d391a5789bbce0d70
SHA1 b27ab6abacf114054043ea959cad3164bca0df02
SHA512 ae0b0f5c162b12c16ba5b0ba9a696f26948cdaa4f4013fe00bda57fcdced3ae16036fdbfe8ac5ef5d39363e04a939dc05d81a3cfbb7f0ace4ca3327b56d0450e
SSDEEP 1536:ZJqwy75UhaasJD0gLFOQpbHtphwSHPPnOED4LZFasOtN9WlQH:SDwiXpxvMZ+tH
TLSH
T1E2B32A7163F00ABA60C343A47B647A597E55D18BE113C1ECB3BE12516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download